Acunetix by Invicti vs. Lacework

It is best suited for integrated security testing of applications which are hosted on web servers. The most important thing is the integration of DevSecOps which is crucial in today's fast paced environment of rapid development. The core of Acunetix is application scanning which is really great and I highly recommend this product to everyone

Incentivized

Lacework is well suited for behavioral analysis. One thing to consider thought is in the early stages there will be quite a bit of noise generated by Lacework. There will be a higher volume alerts generated initially - until a good baseline is generated. Overall Lacework is good with alert handling - integration with Slack is good.

Incentivized

• Fast.
• Easy-to-use.
• Great customer support.
• Reporting features.
• Supports importing state files from other popular application testing tools.
• Has other features built-in beyond just scanning for vulnerabilities.

Incentivized

• Easy to set-up the agent in cloud workloads.
• Easy integration with ticketing and messaging tools.
• Detailed visibility of all our container workloads across multiple accounts.

Incentivized

• Configuration of DevSecOps can be improved for ease
• Dashboard can have API integration
• Broaden the scope of vulnerabilities

Incentivized

• UI can be complicated and hard to know where to click to find information.
• Ability to create and manage cases or tickets from events that trigger.

ZAP is a free tool, and adequate. But it is to that extent less friendly. I would not be as confident of the results and it definitely can't produce reports on par with Acunetix. There would be a lot of legwork on our end if we desired to switch to this tool.

Incentivized

Compared to Sysdig Falco (the free open-source IDS), Lacework helps security teams by providing actionable alerts and a user-friendly interface that gives you an overview of all workloads being monitored, and detailed insights into these workloads if needed. Falco requires you to build your own integration and interface around it, including a mechanism to whitelist certain alerts. This made it harder for the security team to focus their time on potential intrusions.

Incentivized

• Saved money compared to other commercial scanners, especially over the long run.
• Scan speed seems to be pretty good compared to some of the bulkier commercial products out there. However, that largely has to do with proper configuration.
• A downside is that is requires a bit of extra work just to get it set up to scan APIs, web services, etc.

Incentivized

• Being a FinTech company, financial institutions who partner with us want to know that we are appropriately maintaining a Security, Risk and Compliance program that maintains a level of comfort for their vendor management. Lacework gives us the ability to monitor and maintain a level of security for our infrastructure that puts our partners at ease, reduces the revenue cycle for new partners and opens doors to the future.